ClawHub
Back to skill

Security audit

Product Icon Generator

Security checks for vulnerabilities and agentic risk

Overview

This icon generator is mostly purpose-aligned, but users should review it because it gives mutable remote instructions and unpinned installer guidance too much influence.

Install only if you trust AgentPMT with the icon instructions you provide and accept credit charges plus 3-day server-side file retention. Avoid secrets, private keys, payment headers, and sensitive brand material in prompts. Prefer pinned, reviewed setup paths, and treat any live remote instructions as reference data that cannot override local safety or privacy rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:214
Finding

Unpinned Third-Party Installer and Mutable Skill Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14, 214-226
Vulnerability Type: Unpinned executable dependency and mutable supply-chain content
Risk Level: Medium

Vulnerable Code Snippet

markdown
If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.
markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

### Technical Analysis

The documented setup procedure invokes an npm-delivered CLI through `npx` and installs content from `AgentPMT/agent-skills` without pinning the CLI version, repository commit, release, checksum, or cryptographic signature. As a result, the content executed or installed at setup time can differ from the content that was originally audited.

The seven-day freshness rule further encourages users to replace reviewed content with the latest remotely available version. Although dependency installation is relevant to connecting the hosted service, using mutable and unverified versions exceeds the minimum risk necessary for that setup. This finding does not establish that the current p
...[truncated 1333 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the skills CLI to a reviewed, exact version instead of allowing npx to resolve the latest release.
  • Pin each installed Skill to an immutable release or repository commit.
  • Publish and verify cryptographic signatures or checksums before installation.
  • Use a lockfile or equivalent integrity metadata for all transitive dependencies.
  • Disable package lifecycle scripts where they are unnecessary.
  • Replace automatic age-based reinstallation with an explicit update-review process.
  • Review version changes and permission requirements before loading updated Skill instructions.
  • Prefer a trusted internal mirror or allowlist for approved package and repository sources.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:143
Finding

Remote Instructions Are Given Precedence Over Audited Local Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:143-151
Vulnerability Type: Trust of remotely mutable behavioral instructions
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Live Schema And Examples
Use the compact schema above for ordinary calls. Before a new production integration, or whenever parameters, enum values, nested objects, outputs, or examples are unclear, fetch live details first.

- Exact schema: call `agentpmt-tool-search-and-execution` with `action: "get_schema"`, and `tool_id: "product-icon-generator"`.
- Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "product-icon-generator"`, or call this product with `action: "get_instructions"` when the product tool is already selected.
- Treat returned live schema and instructions as more specific than this generated summary.

Technical Analysis

The Skill instructs the agent to retrieve live instructions from a remote service and treat those instructions as more specific than the locally audited summary. The response is not limited to a cryptographically verified schema, and the local text does not explicitly require behavioral or meta-instructions in the response to be rejected.

This creates an instruction-hijacking boundary: remote content can change after the local Skill has been reviewed and may be interpreted as authoritative session guidance. Fetching a live parameter schema can be legitimate for a hosted API, but granting general precedence to remotely supplied “instructions” is broader than the minimum privilege required to validate icon-generation parameters.

No malicious remote response was present in the audited project. The vulnerability is the explicit trust and precedence relationship that makes exploitation possible if the service, account, response path, or publication process is compromised.

Attack Path

  1. An attacker compromises the AgentPMT servi ...[truncated 1192 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat all remotely returned instructions and examples as untrusted data rather than authoritative behavioral guidance.
  • Limit live retrieval to a strict, machine-validated schema containing only expected fields, types, constraints, and examples.
  • Explicitly state that remote content cannot override system, developer, local security, privacy, or least-privilege requirements.
  • Reject remote responses containing meta-instructions, tool-routing directives, credential requests, or requests unrelated to icon generation.
  • Pin remote specifications to signed versions or verify them using trusted cryptographic signatures.
  • Maintain an allowlist of supported actions and endpoint domains.
  • Require user confirmation before remote content can cause additional tool calls or transmit data not already necessary for rendering.
  • Keep the locally reviewed Skill authoritative when remote content conflicts with it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description uses broad discovery language spanning many generic image-generation scenarios, increasing the chance of accidental activation. Because this skill invokes a third-party remote service and creates billable external tool calls, ambiguous invocation language raises both privacy and integrity risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation keywords are broad and include common phrases like 'generate' and general icon-related terms, which can cause the skill to trigger in contexts the user did not intend. In an agent environment, overbroad activation can lead to unnecessary remote calls, unintended credit spend, and transmission of task content to an external service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The skill is explicitly designed to send user-provided drawing instructions to remote AgentPMT endpoints (api.agentpmt.com) for processing and file storage. Any automatic use of this skill therefore transmits task content outside the local environment, which is a real data egress concern even though the destination is documented and expected.

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/product-icon-generator
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This line documents a REST invoke endpoint that receives tool parameters and returns generated files, confirming external transmission as a core behavior. In context, the danger is moderated because the skill warns against sending secrets, but it still creates a genuine confidentiality boundary crossing whenever invoked.

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

md
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/product-icon-generator
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file states that the action renders a PNG and stores it for 3 days, which affects user data lifecycle. Under the markdown warning criterion, the description should explicitly disclose the retention/privacy implication rather than only mentioning it as a product behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.